Executive brief
IBM Langflow is an open-source platform for building and running AI workflows. A flaw in the file-reading component allows authenticated users to access files belonging to other users by manipulating file paths in API requests, potentially exposing sensitive data uploaded by other organizations or individuals using the same Langflow instance.
Technical details
This vulnerability is an improper access control issue in the File/Read File component used within Langflow flows. When flows are executed via the /api/v1/run/advanced/{flow_id} endpoint, component inputs can reference storage paths with arbitrary user or flow identifiers without ownership verification. An authenticated attacker can craft file paths pointing to another user's storage namespace to read and return file contents uploaded by other users, bypassing authorization checks in the file management API. Exploitation requires valid authentication credentials but no special privileges.
Affected products
- IBM Langflow 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed